V-285662

Discussion

Operating system management includes the ability to control the number of users and user sessions that use an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to denial-of-service (DoS) attacks. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.

Check Content

Verify Harvester Government enforces security limits for concurrent sessions and core dump generation.

1. Access Harvester Government using a privileged account and verify the security limits configuration file exists and is protected:

stat -c "%n %a %U %G" /etc/security/limits.conf

2. Verify the output returns:

/etc/security/limits.conf 600 root root

If "/etc/security/limits.conf" does not exist, is not owned by root:root, or has permissions more permissive than 600, this is a finding.

3. Review the configured security limits:

grep -E "^\*[[:space:]]+(hard[[:space:]]+maxlogins|soft[[:space:]]+core|hard[[:space:]]+core)" /etc/security/limits.conf

4. Verify the following values are configured:

* hard maxlogins 10
* soft core 0
* hard core 0

5. Verify the configuration enforces a maximum of 10 concurrent logins for all users, a soft core dump size of 0, and a hard core dump size of 0.

If the maximum concurrent login limit is missing, commented out, or configured with a value greater than 10, this is a finding.

If either the soft or hard core dump limit is missing, commented out, or configured with a value other than 0, this is a finding.